TraceTogether wearable token in Singapore needs to gain users’ trust

When the Singapore government said last week that it was giving out wearable tokens to everyone for contact tracing, one image immediately came to mind – the ankle or wrist bracelets used to monitor lawbreakers out on probation.

So, it is a relief to hear today that these tokens, which will be given out from later this month, do not track a wearer’s whereabouts with a GPS chip and do not transmit data wirelessly via a mobile network.

Minister-in-charge of the Smart Nation programme, Dr Vivian Balakrishnan, said in a media briefing today that the wearable will use Bluetooth to track whom the user has been in proximity with.

Data will be kept encrypted in the device, which will be deleted after 25 days, he said, adding that it would only be accessed by authoritised contact tracers should a user become infected.

This also means there isn’t a big database that the government keeps on everyone, which is surely one concern for the more than 32,000 people who have signed a petition against such a device.

Essentially, this TraceTogether wearable device promises to do what the similarly named app cannot, because of issues it has with Apple iPhones, which turns off Bluetooth scanning when the app runs in the background.

So far so good. Indeed, it’s refreshing to hear the government come forward to explain how a potentially controversial device could accomplish its contact tracing task without causing widespread privacy concerns.

Even before this, it has been good to hear the GovTech folks explain how the TraceTogether app worked when it first appeared in March.

Understanding how users felt about the app – we’ve been told to be wary of what we install on our phones, after all – they went to lengths to be transparent about the app’s code and what data was collected.

It took a while longer for another app – the SafeEntry check-in app – to have an important detail published in its FAQ, but it is clear now that your check-ins to the mall or school each day are not kept beyond 25 days.

This is the standard that future government apps should follow. They should not only adhere to the data protection policies laid out in a long policy document but also clearly explain to users how they handle the data.

In the case of contact tracing, users are not given a choice – they have to reveal whom they have been in contact with if they are infected – so it is important that the bar for collecting and using that personal data is high.

For now, the government seems to be careful about saying the wearable is mandatory. It “may” be issued to everyone, according to The Straits Times today.

So, there are still questions. If you’re issued a wearable, do you have to put it on all the time? What happens if it is damaged or faulty? Would you be held responsible if the data on it is lost, as a result?

Perhaps more importantly, how long will people have to carry it, if it is made mandatory? For those unfortunate to be infected, how long will that data be kept? Can it be restricted to contact tracing and not other purposes?

Remember that there are more than a dozen circumstances where a government agency can disclose personal data without consent, including for investigations and proceedings. This is rather broad.

For this reason, the wearable’s use should be narrowly defined. It must be used for only one purpose – contact tracing – and this should be made abundantly clear to citizens.

In making this wearable available to everyone, the government knows that it still needs buy-in from users to make contact tracing work. Its mission, after all, is to fight the pandemic.

Just like the other social distancing rules put in place during this difficult time, like the limit to visits to family members, the emphasis should be on helping citizens.

The wearable is not supposed to “catch” people breaking the law – it is meant to ensure that everyone in the country can fight the pandemic together. That has to be clear.

CORRECTION at 12:20am 09/06/2020: In an earlier version of the story, Dr Vivian Balakrishnan was reported to be speaking in Parliament on Monday. This is incorrect. He was speaking to reporters in a media briefing on Monday after discussing the wearable device last Friday in Parliament. We are sorry for the error.